SUSE SLES12 Security Update : postgresql, postgresql15, postgresql16 (SUSE-SU-2023:4425-1)

high Nessus Plugin ID 185597



The remote SUSE host is missing one or more security updates.


The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4425-1 advisory.

- PostgreSQL Project reports: Certain aggregate function calls receiving unknown-type arguments could disclose bytes of server memory from the end of the unknown-type value to the next zero byte. One typically gets an unknown-type value via a string literal having no type designation. We have not confirmed or ruled out viability of attacks that arrange for presence of notable, confidential information in disclosed bytes.

- PostgreSQL Project reports: While modifying certain SQL array values, missing overflow checks let authenticated database users write arbitrary bytes to a memory area that facilitates arbitrary code execution. Missing overflow checks also let authenticated database users read a wide area of server memory. The CVE-2021-32027 fix covered some attacks of this description, but it missed others. (CVE-2023-5869)

- PostgreSQL Project reports: Documentation says the pg_cancel_backend role cannot signal a backend owned by a superuser. On the contrary, it can signal background workers, including the logical replication launcher. It can signal autovacuum workers and the autovacuum launcher. Signaling autovacuum workers and those two launchers provides no meaningful exploit, so exploiting this vulnerability requires a non-core extension with a less-resilient background worker. For example, a non-core background worker that does not auto-restart would experience a denial of service with respect to that particular background worker. (CVE-2023-5870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 185597

File Name: suse_SU-2023-4425-1.nasl

Version: 1.3

Type: local

Agent: unix

Published: 11/14/2023

Updated: 2/16/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information


Risk Factor: High

Score: 7.4


Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-5869


Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:libecpg6, p-cpe:/a:novell:suse_linux:libecpg6-32bit, p-cpe:/a:novell:suse_linux:libpq5, p-cpe:/a:novell:suse_linux:libpq5-32bit, p-cpe:/a:novell:suse_linux:postgresql, p-cpe:/a:novell:suse_linux:postgresql-contrib, p-cpe:/a:novell:suse_linux:postgresql-devel, p-cpe:/a:novell:suse_linux:postgresql-docs, p-cpe:/a:novell:suse_linux:postgresql-plperl, p-cpe:/a:novell:suse_linux:postgresql-plpython, p-cpe:/a:novell:suse_linux:postgresql-pltcl, p-cpe:/a:novell:suse_linux:postgresql-server, p-cpe:/a:novell:suse_linux:postgresql-server-devel, p-cpe:/a:novell:suse_linux:postgresql15, p-cpe:/a:novell:suse_linux:postgresql15-contrib, p-cpe:/a:novell:suse_linux:postgresql15-devel, p-cpe:/a:novell:suse_linux:postgresql15-docs, p-cpe:/a:novell:suse_linux:postgresql15-plperl, p-cpe:/a:novell:suse_linux:postgresql15-plpython, p-cpe:/a:novell:suse_linux:postgresql15-pltcl, p-cpe:/a:novell:suse_linux:postgresql15-server, p-cpe:/a:novell:suse_linux:postgresql15-server-devel, p-cpe:/a:novell:suse_linux:postgresql16, p-cpe:/a:novell:suse_linux:postgresql16-contrib, p-cpe:/a:novell:suse_linux:postgresql16-devel, p-cpe:/a:novell:suse_linux:postgresql16-docs, p-cpe:/a:novell:suse_linux:postgresql16-plperl, p-cpe:/a:novell:suse_linux:postgresql16-plpython, p-cpe:/a:novell:suse_linux:postgresql16-pltcl, p-cpe:/a:novell:suse_linux:postgresql16-server, p-cpe:/a:novell:suse_linux:postgresql16-server-devel, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/13/2023

Vulnerability Publication Date: 11/9/2023

Reference Information

CVE: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870

IAVB: 2023-B-0088-S

SuSE: SUSE-SU-2023:4425-1